CVE-2026-15117 is a use-after-free vulnerability in the Payments feature of Google Chrome before version 150.0.7871.115. An attacker who persuades a user to interact with a specially crafted HTML page through specific UI gestures may trigger heap corruption, potentially leading to arbitrary code execution or other impacts. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed and patched in Chrome 150.0.7871.115.

Successful exploitation can lead to heap corruption, which may allow an attacker to execute arbitrary code, compromise user data confidentiality and integrity, and disrupt availability. The attack requires user interaction and specific UI gestures, limiting the attack vector to scenarios where a user visits a maliciously crafted web page and performs the required actions.

A fixed version, Chrome 150.0.7871.115, is available. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html for detailed update instructions.